An organization is investigating a data breach that involved stolen customer data being sold on the dark web. The intelligence team needs to monitor dark web marketplaces. Which data source is most appropriate for this requirement?

Dark web monitoring services that index and track marketplace listings

A threat intelligence team is planning a collection effort to support a phishing campaign analysis. They have limited staff and need to collect data from multiple sources, including internal email logs, public URL scanners, and social media. What should be the first step in their collection plan?

Select the most reliable source and collect only from it to simplify the process

Deploy automated collection tools to all sources immediately to maximize data volume

Begin collecting data from social media because it is publicly accessible and requires no permissions

Define the intelligence requirements and scope, such as the specific phishing indicators and time frame

An analyst is collecting threat intelligence from a newly discovered open-source feed. The feed has been active for only a week and has already reported several major attacks that other feeds have not confirmed. What should the analyst do to address source reliability concerns?

Ignore the feed entirely because it is too new to be reliable

Cross-verify the feed's reports with other established sources before using the data

Immediately block all indicators from the feed to protect the organization

Trust the feed because it reports major attacks that others miss

A threat intelligence team is collecting data from a variety of sources, including open-source feeds, dark web forums, and internal telemetry. The team is struggling with data overload and conflicting reports about the same threat. They need to produce a timely intelligence report for executives. What is the most effective way to handle these challenges?

Include all data in the report to be comprehensive

Establish a data triage process that filters, correlates, and prioritizes data based on the intelligence requirements

Collect only from the most reliable source to avoid conflicts

Delay the report until all data is fully verified

EC-CouncilThreat Intelligence Essentials

Domain 4Objective 2

Data Collection Methods and Techniques TIE Practice Questions (Page 4)

Part of the Data Collection and Sources domain, which makes up ~13% of our current practice bank.

36questions here

8free pages

5concepts

Questions 16–20

16application · medium
An organization is investigating a data breach that involved stolen customer data being sold on the dark web. The intelligence team needs to monitor dark web marketplaces. Which data source is most appropriate for this requirement?
Select an answer first
17application · medium
A threat intelligence team is planning a collection effort to support a phishing campaign analysis. They have limited staff and need to collect data from multiple sources, including internal email logs, public URL scanners, and social media. What should be the first step in their collection plan?
Select an answer first
18application · medium
An analyst is collecting threat intelligence from a newly discovered open-source feed. The feed has been active for only a week and has already reported several major attacks that other feeds have not confirmed. What should the analyst do to address source reliability concerns?
Select an answer first
19expert · hard
A threat intelligence team is collecting data from a variety of sources, including open-source feeds, dark web forums, and internal telemetry. The team is struggling with data overload and conflicting reports about the same threat. They need to produce a timely intelligence report for executives. What is the most effective way to handle these challenges?
Select an answer first
20foundation · easy
Which component of a data collection plan defines the specific information needed and the questions the intelligence effort aims to answer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TIE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “TIE” is a trademark of its owner, used for identification only.

Data Collection Methods and Techniques TIE Practice Questions (Page 4)

Questions 16–20

An organization is investigating a data breach that involved stolen customer data being sold on the dark web. The intelligence team needs to monitor dark web marketplaces. Which data source is most appropriate for this requirement?

A threat intelligence team is planning a collection effort to support a phishing campaign analysis. They have limited staff and need to collect data from multiple sources, including internal email logs, public URL scanners, and social media. What should be the first step in their collection plan?

An analyst is collecting threat intelligence from a newly discovered open-source feed. The feed has been active for only a week and has already reported several major attacks that other feeds have not confirmed. What should the analyst do to address source reliability concerns?

Which component of a data collection plan defines the specific information needed and the questions the intelligence effort aims to answer?

Keep studying — Data Collection and Sources